As an expert programmer, I want to point out that programming isn't even a core requirement of programming. Indeed, it's a great track for promotion, because they don't want to lose the good programmers to management.
A lot of infosec people think they can't program, that they can only write small scripts or make a few changes to existing scripts in languages like Ruby or JavaScript. This is actually better than a lot of professional programmers.
Indeed, our employment in infosec often comes from programmers being bad at their job. They don't understand how SQL injection is possible, but I can't comprehend how they can't understand it!!! It's obvious!
